Splunk Search

Filter data from json file

drogo
Explorer

Team,
I am bit new to Splunk, need help to pull ERR message from below sample raw data. 

{"hosting_environment": "nonp", "application_environment": "nonp", "message": "[20621] 2024/11/14 12:39:46.899958 [ERR] 10.25.1.2:30080 - pid:96866" - unable to connect to endpoint , "service": "hello world"}

 

Thanks!

Labels (2)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

If your events are truly in JSON, you are asking the wrong question.  Let me explain.

The sample you illustrated above is not JSON compliant.  Specifically, quotation marks are badly placed.  So, the most important question is whether the sample is faithful.  Or do you mean a compliant JSON like this:

{"hosting_environment": "nonp", "application_environment": "nonp", "message": "[20621] 2024/11/14 12:39:46.899958 [ERR] 10.25.1.2:30080 - pid:96866 - unable to connect to endpoint", "service": "hello world"}

Assuming your raw events are JSON compliant, Splunk would give you a field named message.  The task is simply to extract the desired part from this field.  In other words, the fact that data is JSON should have no bearing on your question.  If I read your mind correctly, you want the string after [ERR]. (I'm not joking about reading mind.  You should always illustrate what you want using sample data.)  Therefore

| rex field=message "\[ERR\] (?<error>.+)"

If, on the other hand, your raw events are mangled like in your illustration, the answer will depend on how badly mangled the events are.  The best solution would be to implore your developers to fix the log.

Either way, the question is really not about JSON.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @drogo ,

if you use the INDEXED_EXTRACTIONS=JSON option for the sourcetype you're using for those data, you have all the fileds extracted.

If you don't see this field, youcan use a regex to extract it:

| rex "\d*\s\[(?<message>[^\]]+)"

that you can test at https://regex101.com/r/QcGAwT/1

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is a bit vague - Do you want to search for events that have ERR in? Do you want to extract what comes after "[ERR}" in the message field? Do you already have these JSON fields extracted?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...